proven for the private market(s) != proven (or even acceptable) for governments

do the risk analysis. what happens when an industry-standard quality control measure fails in whatever way for a private company? some hit to their reputation, stock price, market share, maybe they even fail. these are perfectly acceptable outcomes for a private organization. they are not acceptable outcomes for governments. governments demand (much) higher standards and more stringent processes. slowness is a feature, not a bug.